Vulnerabilities > CVE-2021-26111 - Memory Leak vulnerability in Fortinet Fortiswitch

CVSS 6.5 - MEDIUM

Attack vector

ADJACENT_NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

low complexity

fortinet

CWE-401

NVD

Published: 2021-06-01

Updated: 2021-06-11

Summary

A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and below may allow an attacker on an adjacent network to exhaust available memory by sending specifically crafted LLDP/CDP/EDP packets to the device.

Vulnerable Configurations

Part	Description	Count
OS	Fortinet Fortinet Fortiswitch 2.0.2 Fortinet Fortiswitch 2.0.3 Fortinet Fortiswitch 3.0.0 Fortinet Fortiswitch 3.0.1 Fortinet Fortiswitch 3.2.0 Fortinet Fortiswitch 3.2.1 Fortinet Fortiswitch 3.2.2 Fortinet Fortiswitch 3.3.1 Fortinet Fortiswitch 3.3.2 Fortinet Fortiswitch 3.3.3 Fortinet Fortiswitch 3.4.0 Fortinet Fortiswitch 3.4.1 Fortinet Fortiswitch 3.4.2 Fortinet Fortiswitch 3.4.3 Fortinet Fortiswitch 3.5.0 Fortinet Fortiswitch 3.5.1 Fortinet Fortiswitch 3.5.2 Fortinet Fortiswitch 3.5.3 Fortinet Fortiswitch 3.5.4 Fortinet Fortiswitch 3.5.5 Fortinet Fortiswitch 3.5.6 Fortinet Fortiswitch 3.6.0 Fortinet Fortiswitch 3.6.1 Fortinet Fortiswitch 3.6.2 Fortinet Fortiswitch 3.6.3 Fortinet Fortiswitch 3.6.4 Fortinet Fortiswitch 3.6.5 Fortinet Fortiswitch 3.6.6 Fortinet Fortiswitch 3.6.7 Fortinet Fortiswitch 3.6.8 Fortinet Fortiswitch 3.6.9 Fortinet Fortiswitch 3.6.10 Fortinet Fortiswitch 3.6.11 Fortinet Fortiswitch 6.0.0 Fortinet Fortiswitch 6.0.1 Fortinet Fortiswitch 6.0.2 Fortinet Fortiswitch 6.0.3 Fortinet Fortiswitch 6.0.4 Fortinet Fortiswitch 6.0.5 Fortinet Fortiswitch 6.0.6 Fortinet Fortiswitch 6.2.0 Fortinet Fortiswitch 6.2.1 Fortinet Fortiswitch 6.2.2 Fortinet Fortiswitch 6.2.3 Fortinet Fortiswitch 6.2.4 Fortinet Fortiswitch 6.2.5 Fortinet Fortiswitch 6.2.6 Fortinet Fortiswitch 6.4.0 Fortinet Fortiswitch 6.4.1 Fortinet Fortiswitch 6.4.2 Fortinet Fortiswitch 6.4.3 Fortinet Fortiswitch 6.4.4 Fortinet Fortiswitch 6.4.5 Fortinet Fortiswitch 6.4.6	54

Common Weakness Enumeration (CWE)

CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

References

https://fortiguard.com/advisory/FG-IR-21-026